Privacy Policy
The short version — what actually matters to you
We only collect what we need
Name, email, phone, job preferences, and visa status. That's it. No CV, no passport, no financial data.
We never sell your data
Your profile is never shared with employers, recruiters, or third parties without your explicit consent. Ever.
Phone number — one account per person
We collect your mobile number to prevent abuse of the free tier. It is not used for marketing calls.
Delete any time
Close your account from your dashboard and all your personal data is deleted within 30 days.
Passwords are hashed — never stored in plain text
All data in transit is encrypted. Your database is on servers we own and control.
UK GDPR applies — you have rights
Right to access, rectify, erase, port, and object. Contact privacy@proofcapital.co.uk anytime.
1. Who we are
Proof Capital Ltd ("we", "us") operates SponsorMatch. Contact: privacy@proofcapital.co.uk.
2. What we collect and why
Account data
- Name, email, hashed password — to create and authenticate your account
- Phone number — one account per person, anti-abuse enforcement only. Not used for marketing.
Profile data
- Job titles, skills, certifications, locations, salary range — to generate your personalised matches
- Visa status and expiry date — optional, improves match precision and activates Runway Mode
- Years of experience, education — for seniority fit scoring
Usage data
- Clicks, applications, interviews, offers — to improve probability scoring (anonymised in aggregate analysis)
- Digest open rates — to confirm delivery and improve timing
What we do NOT collect
- CV, passport, or identity documents
- Payment card data (Stripe handles this independently)
- Cross-site tracking data
3. Legal basis (UK GDPR)
- Contract: Processing your data to deliver the service you signed up for
- Legitimate interest: Improving our model with anonymised outcome data
- Consent: Email digests — unsubscribe any time
4. Who we share data with
We do not sell your data. Sub-processors: Stripe (payments), Mailgun (email delivery), Anthropic/Claude (AI draft generation — only job title and career field passed, no personal identifiers).
5. Retention
Personal data deleted within 30 days of account closure. Transaction records retained 7 years (tax law). Anonymised aggregate data retained indefinitely.
6. Your rights
Access, rectify, erase, port, object, withdraw consent. Email privacy@proofcapital.co.uk. Complaints to the ICO.
7. Security
Servers in UK/EU. Passwords bcrypt-hashed. All transit TLS-encrypted. Production DB access restricted to authorised personnel.
8. Cookies
Essential session cookies only. No advertising or tracking cookies.